10.6.3. Changing the authentication signals

The NIDEN, DBGEN, SPIDEN,
and SPNIDEN input signals are
either tied off to some fixed value or controlled by some external
device.

If software running on the processor has control over an external
device that drives the authentication signals, it must make the
change using a safe sequence:

Execute an implementation-specific sequence of instructions
to change the signal value. For example, this might be a single STR instruction
that writes certain value to a control register in a system peripheral.

Poll the DBGDSCR or Authentication Status Register
to check whether the processor has already detected the changed
value of these signals. This is required because the system might
not issue the signal change to the processor until several cycles
after the DSB instruction completes.

Issue an ISB instruction exception
entry or exception return.

The software cannot perform debug or analysis operations that
depend on the new value of the authentication signals until this
procedure is complete. The same rules apply when the debugger has
control of the processor through the Instruction Transfer Register,
DBGITR, while in debug state. The relevant combinations of the DBGEN, NIDEN, SPIDEN, and SPNIDEN values
can be determined by polling DSCR[17:16], DSCR[15:14], or the Authentication
Status Register.